Using KooCLI and kubectl to Access a Cluster

Step 1: Download kubectl

Before using kubectl to access a cluster, install kubectl on the client. Run the kubectl version command to check whether kubectl is installed. If it is installed, skip this step. This section uses Linux as an example to describe how to install and configure kubectl. For details, see Installing kubectl.

1. Log in to your client and download kubectl. v1.35.0 is used as an example version. Replace it with your target version as needed.

   cd /home
   curl -LO https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl

2. Run the following command to install kubectl:

   chmod +x kubectl
   mv -f kubectl /usr/local/bin

3. Run the following command to check whether kubectl has been installed:

   kubectl version

   If information similar to the following is displayed, kubectl has been installed:

   Client Version: xxx
   Kustomize Version: xxx
   Server Version: xxx

Step 2: Install KooCLI

Run hcloud version to check whether KooCLI is installed. If KooCLI is installed and the version is 7.2.12 or later, skip this step. If KooCLI is installed but the version does not meet the requirements, reinstall KooCLI.

For details about how to install KooCLI, see Getting Started.

Step 3: Configure KooCLI

KooCLI supports multiple configuration methods. This section describes two common methods. For more configuration options, see the KooCLI Documentation.

Method 1: Using a permanent AK/SK (applicable to most users)

Run the following command to configure KooCLI:

hcloud configure set --cli-profile=${profileName} --cli-region=${region} --cli-mode=AKSK --cli-access-key=${AK} --cli-secret-key=${SK}

Check whether the configuration is successful.

hcloud configure show --cli-profile=${profileName}

${profileName} indicates the custom KooCLI profile name. ${region} indicates the region ID. ${AK} indicates the Access Key ID from the permanent AK/SK pair. ${SK} indicates the Secret Access Key from the permanent AK/SK pair.

Method 2: Using SSO login (for IAM Identity Center users)

Run the following command to configure KooCLI:

# Step 1
hcloud configure set --cli-mode=SSO --cli-profile=${profileName} --cli-sso-start-url=${sso_start_url} --cli-sso-region=${region} --cli-region=${region}
# Step 2
hcloud configure sso --cli-profile=${profileName}

${profileName} indicates the custom KooCLI profile name. ${region} indicates the region ID. ${sso_start_url} indicates the IAM Identity Center URL. For details, see the documentation.

hcloud configure sso is an interactive command. Follow the prompts to complete the SSO login.

KooCLI saves the configuration locally. Sensitive information, such as authentication credentials (AK/SK), is encrypted at rest.

Step 4: Use KooCLI to Generate kubeconfig

1. Run the following command to view the clusters of the current user:

   hcloud cce list-cluster 

   After the command is executed, output similar to the following is displayed:

   UID                                      NAME                                     VERSION         STATUS          ACCESS              
   ----------------------------------------------------------------------------------------------------------------------------------
   9e07d2cf-02db-11ef-acea-0255ac100b08     cce-cluster-1                            v1.28           Unavailable     Internal                     
   6a533499-e9e8-11f0-b1d8-0255ac1001b8     cce-cluster-2                            v1.33           Available       Internal/External

2. Select the target cluster and run the following command to generate the kubeconfig file:

   # Private access
   hcloud cce update-kubeconfig --cluster-id=${clusterID}
   # Public access (supported only when the cluster has an EIP bound)
   hcloud cce update-kubeconfig --cluster-id=${clusterID} --external=true

   $(clusterID) indicates the cluster ID. After the kubeconfig file is generated, output similar to the following is displayed:

   Successfully generated/updated kubeconfig at: /root/.kube/config 
   Context: ***** 
   Cluster: *****

   The table below lists the configurable parameters for hcloud cce update-kubeconfig. You can also run hcloud cce update-kubeconfig --help to view them.

   Parameter	Description
   --output	Path for storing the generated kubeconfig file. The default value is ~/.kube/config.
   --external	Whether to access the cluster through a public network. The default value is false.
   --external-tls-verify	Whether to enable two-way authentication when accessing a cluster through a public network. The default value is false.
   --ak	Access Key ID, which is obtained from the KooCLI configuration by default.
   --sk	Secret Access Key, which is obtained from the KooCLI configuration by default.
   --security-token	Security token, which is obtained from the KooCLI configuration by default.
   --region	Region ID, which is obtained from the KooCLI configuration by default.
   --project-id	Project ID, which is obtained from the KooCLI configuration by default.
   --user-name	Username in the generated kubeconfig file. The default value is {cluster-name}-user.
   --context-name	Context name in the generated kubeconfig file. The default value is {cluster-name}-context.
   --cce-endpoint	Domain name for accessing CCE. The default value is https://cce.{region}.myhuaweicloud.com.

3. Run the following command to check whether the cluster can be accessed using kubectl:

   kubectl cluster-info

   If the following information is displayed, the cluster can be accessed using kubectl:

   Kubernetes control plane is running at https://xx.xx.xx.xx:5443 CoreDNS is running at https://xx.xx.xx.xx:5443/api/v1/namespaces/kube-system/services/coredns:dns/proxy 
   To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

   

   • When you use kubectl with credential plugins to access a cluster, the Kubernetes permissions are the same as those granted to the IAM user on the CCE console.
   • In Linux, if the KUBECONFIG environment variable is set, kubectl loads that configuration instead of $home/.kube/config.
   • When you access a cluster via a public network, two-way authentication is disabled by default. To enable it, set external-tls-verify=true in update-kubeconfig.